Summary
USN-6591-1 fixed vulnerabilities in Postfix. A fix with less risk of
regression has been made available since the last update. This update
updates the fix and aligns with the latest configuration guidelines
regarding this vulnerability.
We apologize for the inconvenience.
Original advisory details:
Timo Longin discovered that Postfix incorrectly handled certain email line
endings. A remote attacker could possibly use this issue to bypass an email
authentication mechanism, allowing domain spoofing and potential spamming.
Please note that certain configuration changes are required to address
this issue. They are not enabled by default for backward compatibility.
Information can be found at https://www.postfix.org/smtp-smuggling.html.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | postfix | 3.4.13-0ubuntu1.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | postfix | 3.6.4-1ubuntu1.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | postfix | 2.11.0-1ubuntu1.2+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | postfix | 3.1.0-3ubuntu0.4+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | postfix | 3.3.0-1ubuntu0.4+esm3 |
Vulnerabilities 1
-
Unscored —CVE-2023-51764 Public exploit
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and…